envpkt 0.16.0 → 0.18.0

package/dist/index.d.ts

@@ -387,19 +387,26 @@ type BootError = ConfigError | FnoxError | CatalogError | AliasError | {
   readonly configuredKeyFile?: string;
 } | IdentityError;
 type IdentityError = {
-  readonly _tag: "AgeNotFound";
-  readonly message: string;
+  readonly _tag: "IdentityNotFound";
+  readonly path: string;
 } | {
-  readonly _tag: "DecryptFailed";
+  readonly _tag: "IdentityUnreadable";
+  readonly path: string;
   readonly message: string;
+} | (IdentityFileError & {
+  readonly source: string;
+});
+/** Why an age identity (key) file can't be used for in-process decryption. Never carries key material. */
+type IdentityFileError = {
+  readonly _tag: "NoIdentityKey";
 } | {
-  readonly _tag: "IdentityNotFound";
-  readonly path: string;
+  readonly _tag: "PassphraseProtectedIdentity";
+} | {
+  readonly _tag: "UnsupportedIdentity";
+  readonly kind: "plugin" | "ssh" | "unknown";
+  readonly line: number;
 };
 type SealError = {
-  readonly _tag: "AgeNotFound";
-  readonly message: string;
-} | {
   readonly _tag: "EncryptFailed";
   readonly key: string;
   readonly message: string;
@@ -412,9 +419,6 @@ type SealError = {
   readonly message: string;
 };
 type KeygenError = {
-  readonly _tag: "AgeNotFound";
-  readonly message: string;
-} | {
   readonly _tag: "KeygenFailed";
   readonly message: string;
 } | {
@@ -579,10 +583,10 @@ declare const envCheck: (config: EnvpktConfig, env: Readonly<Record<string, stri
 declare const generateTomlFromScan: (matches: ReadonlyArray<MatchResult>) => string;
 //#endregion
 //#region src/core/boot.d.ts
-/** Programmatic boot — returns Either<BootError, BootResult> */
-declare const bootSafe: (options?: BootOptions) => Either<BootError, BootResult>;
-/** Programmatic boot — throws EnvpktBootError on failure (intentional throwing wrapper over bootSafe) */
-declare const boot: (options?: BootOptions) => BootResult;
+/** Programmatic boot — resolves to Either<BootError, BootResult> */
+declare const bootSafe: (options?: BootOptions) => Promise<Either<BootError, BootResult>>;
+/** Programmatic boot — rejects with EnvpktBootError on failure (intentional throwing wrapper over bootSafe) */
+declare const boot: (options?: BootOptions) => Promise<BootResult>;
 /** Error class for boot() failures */
 declare class EnvpktBootError extends Error {
   readonly error: BootError;
@@ -590,14 +594,17 @@ declare class EnvpktBootError extends Error {
 }
 //#endregion
 //#region src/core/seal.d.ts
-/** Encrypt a plaintext string using age with the given recipient public key (armored output) */
-declare const ageEncrypt: (plaintext: string, recipient: string) => Either<SealError, string>;
-/** Decrypt an age-armored ciphertext using the given identity file */
-declare const ageDecrypt: (ciphertext: string, identityPath: string) => Either<SealError, string>;
+/** Encrypt a plaintext string to an age recipient public key (armored output) */
+declare const ageEncrypt: (plaintext: string, recipient: string) => Promise<Either<SealError, string>>;
+/**
+ * Decrypt an age-armored ciphertext with any of the given secret keys (`AGE-SECRET-KEY-…`, as
+ * returned by `unwrapAgentKey`). The plaintext is returned as-is, untrimmed.
+ */
+declare const ageDecrypt: (ciphertext: string, identities: ReadonlyArray<string>) => Promise<Either<SealError, string>>;
 /** Seal multiple secrets: encrypt each value with the recipient key and set encrypted_value on meta */
-declare const sealSecrets: (meta: Readonly<Record<string, SecretMeta>>, values: Readonly<Record<string, string>>, recipient: string) => Either<SealError, Record<string, SecretMeta>>;
-/** Unseal secrets: decrypt encrypted_value for each meta entry that has one */
-declare const unsealSecrets: (meta: Readonly<Record<string, SecretMeta>>, identityPath: string) => Either<SealError, Record<string, string>>;
+declare const sealSecrets: (meta: Readonly<Record<string, SecretMeta>>, values: Readonly<Record<string, string>>, recipient: string) => Promise<Either<SealError, Record<string, SecretMeta>>>;
+/** Unseal secrets: decrypt encrypted_value for each meta entry that has one, with any of `identities` */
+declare const unsealSecrets: (meta: Readonly<Record<string, SecretMeta>>, identities: ReadonlyArray<string>) => Promise<Either<SealError, Record<string, string>>>;
 //#endregion
 //#region src/core/keygen.d.ts
 /** Resolve the age identity file path: ENVPKT_AGE_KEY_FILE env var > ~/.envpkt/age-key.txt */
@@ -607,7 +614,7 @@ declare const resolveInlineKey: () => Option<string>;
 /** Generate an age keypair and write to disk. Refuses to overwrite if the file already exists. */
 declare const generateKeypair: (options?: {
   readonly outputPath?: string;
-}) => Either<KeygenError, KeygenResult>;
+}) => Promise<Either<KeygenError, KeygenResult>>;
 type UpdateIdentityOptions = {
   readonly recipient: string;
   readonly keyFile?: string;
@@ -742,14 +749,14 @@ declare const detectFnox: (dir: string) => Option<string>;
 declare const fnoxAvailable: () => boolean;
 //#endregion
 //#region src/fnox/identity.d.ts
-/** Check if the age CLI is available on PATH */
-declare const ageAvailable: () => boolean;
 /**
- * Extract the secret key from an age identity file (plain or encrypted).
- * - Plain identity files (from `age-keygen`) contain `AGE-SECRET-KEY-*` lines directly
- * - Encrypted identity files need `age --decrypt` to unwrap
+ * Read every secret key from a plain age identity file (as written by `envpkt keygen` or
+ * `age-keygen`). A missing or unreadable file, and passphrase-protected, plugin and SSH key files,
+ * are rejected with a typed error.
  */
-declare const unwrapAgentKey: (identityPath: string) => Either<IdentityError, string>;
+declare const unwrapAgentKey: (identityPath: string) => Either<IdentityError, ReadonlyArray<string>>;
+/** Explain an identity error. Never includes key material. */
+declare const describeIdentityError: (err: IdentityError) => string;
 //#endregion
 //#region src/fnox/parse.d.ts
 /** Read and parse fnox.toml, extracting secret keys and profiles */
@@ -785,4 +792,4 @@ type ToolDef = {
 declare const toolDefinitions: readonly ToolDef[];
 declare const callTool: (name: string, args: Record<string, unknown>) => CallToolResult;
 //#endregion
-export { type AgentIdentity, AgentIdentitySchema, type AliasError, type AliasTable, type AuditResult, type BootError, type BootOptions, type BootResult, type CallbackConfig, CallbackConfigSchema, type CatalogError, type ChangedEntry, type CheckResult, type ConfidenceLevel, type ConfigDiff, type ConfigError, type ConfigSource, ConsumerType, type CredentialPattern, type DirectLogger, type DirectTestLoggerHandle, type DotenvEntry, type DriftEntry, type DriftStatus, type EnvAuditResult, type EnvDriftEntry, type EnvDriftStatus, type EnvMeta, EnvMetaSchema, EnvpktBootError, type EnvpktConfig, EnvpktConfigSchema, type FieldChange, type FleetAgent, type FleetHealth, type FnoxConfig, type FnoxError, type FnoxSecret, type FormatDotenvOptions, type FormatPacketOptions, type HealthStatus, type Identity, type IdentityError, IdentitySchema, type KeygenError, type KeygenResult, type LifecycleConfig, LifecycleConfigSchema, type LogEntry, type LogLevel, type LogMetadata, type MatchResult, type McpConfigError, type McpHeader, McpHeaderSchema, type McpHeadersError, type ResolveOptions, type ResolveResult, type ResolvedPath, type ScanOptions, type ScanResult, type SealError, type SecretDisplay, type SecretHealth, type SecretMeta, SecretMetaSchema, type SecretStatus, type SectionDiff, type TomlEditError, type ToolsConfig, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, replaceSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };
+export { type AgentIdentity, AgentIdentitySchema, type AliasError, type AliasTable, type AuditResult, type BootError, type BootOptions, type BootResult, type CallbackConfig, CallbackConfigSchema, type CatalogError, type ChangedEntry, type CheckResult, type ConfidenceLevel, type ConfigDiff, type ConfigError, type ConfigSource, ConsumerType, type CredentialPattern, type DirectLogger, type DirectTestLoggerHandle, type DotenvEntry, type DriftEntry, type DriftStatus, type EnvAuditResult, type EnvDriftEntry, type EnvDriftStatus, type EnvMeta, EnvMetaSchema, EnvpktBootError, type EnvpktConfig, EnvpktConfigSchema, type FieldChange, type FleetAgent, type FleetHealth, type FnoxConfig, type FnoxError, type FnoxSecret, type FormatDotenvOptions, type FormatPacketOptions, type HealthStatus, type Identity, type IdentityError, type IdentityFileError, IdentitySchema, type KeygenError, type KeygenResult, type LifecycleConfig, LifecycleConfigSchema, type LogEntry, type LogLevel, type LogMetadata, type MatchResult, type McpConfigError, type McpHeader, McpHeaderSchema, type McpHeadersError, type ResolveOptions, type ResolveResult, type ResolvedPath, type ScanOptions, type ScanResult, type SealError, type SecretDisplay, type SecretHealth, type SecretMeta, SecretMetaSchema, type SecretStatus, type SectionDiff, type TomlEditError, type ToolsConfig, ToolsConfigSchema, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, describeIdentityError, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, replaceSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };